Barva — Privacy Policy
Last updated: 29 October 2026
Draft — not legal advice. This is written in good faith to be accurate about what the app actually does, and it needs a solicitor's review before launch, particularly on UK GDPR and Australian Privacy Act obligations.
Barva is an app for tracking nights out. This policy explains what we collect, why, who can see it, and how to get rid of it.
We collect the least we can get away with. There is no advertising in Barva, no third-party analytics SDK, and we do not sell or share your data with data brokers.
Who we are
Barva is operated from Australia. For privacy questions, and to exercise any of the rights below, contact support@barvaapp.com.
What we collect
When you create an account
- Email address — to sign you in and to send account emails (password reset, security notices). We do not send marketing email.
- Date of birth — Barva is for people of legal drinking age, and the App Store requires an age check for alcohol-related apps. Your date of birth is used once, to confirm you are 18 or over. It is stored on your private authentication record, not on your public profile, and is never shown to other users.
- Username, display name, and password — a password is stored only as a cryptographic hash, never in a form we or anyone else can read.
What you choose to add
- Profile — avatar, bio, and city, if you fill them in. City only; Barva never asks for a street address.
- Sessions — start and end times, drinks logged, drink types, cost estimates, venue check-ins, titles, and notes.
- Location — while a session is running and only if you enable GPS for that session, the app records a trail of coordinates so it can draw your route and measure distance. Barva does not track your location in the background or when no session is running. You can run a session with GPS off and lose nothing but the map.
- Photos and video — images you attach to a session, and photos or clips you attach to a chug. These are stored privately and served only to people the post itself is visible to.
- Social activity — who you follow, your Circle, cheers, comments, tags, shouts, and reports you file.
What we collect automatically
- Basic technical data needed to run the service: your IP address at the time of a request, and timestamps of account activity, kept by our infrastructure provider for security and abuse prevention.
We do not collect contacts, browsing history, health data, advertising identifiers, or any device sensor other than location as described above.
Who can see what
Barva is privacy-first by design. Sessions default to followers, never to public, and you can change the default or set a per-session audience.
- Other users see only what your audience settings allow. Individual stats (pace, drink count, cost, start time) can each be hidden.
- Live location, if you enable it, is visible only to your Circle, only for that one session, and never persists to the next one.
- Your date of birth and email are never shown to other users.
- Blocked accounts cannot see your posts or profile.
Where your data lives
Barva's backend runs on Supabase (database, authentication, and file storage), which processes data on our behalf under its own security and data protection terms. Data may be stored on servers outside your country. We do not use any other third-party processor for your content.
How long we keep it
Your data stays until you delete it. Deleting a session deletes its drinks, venues, photos, cheers, and comments. Deleting your account deletes your profile and everything attached to it (see below).
Reports you file about other people are kept while they are being reviewed, so that moderation decisions can be made and audited. They are deleted with your account if you close it; a decision already made on a report stays in force.
Your rights
Access and portability — Settings → Account → Export my data produces a complete JSON file of your profile, stats, and every session.
Deletion — Settings → Account → Delete account permanently removes your account, profile, sessions, drinks, uploaded photos, comments, cheers, follows, and Circle links. It is immediate, there is no recovery window, and it cannot be undone.
Two things outlive it, both deliberately. Where someone else's notification history refers to you, the notification survives with the actor shown as a deleted account — it keeps the fact that something happened, but nothing that identifies you and nothing you wrote. And if you recorded a chug for someone else, that proof photo or video belongs to their record and stays with it; your own chugs and their media are deleted with everything else.
Correction — you can edit your profile and your posted sessions in the app at any time.
Objection and complaint — write to support@barvaapp.com. If you are in the UK you may also complain to the Information Commissioner's Office; in Australia, to the Office of the Australian Information Commissioner.
Children
Barva is not for anyone under 18, and we do not knowingly collect data from anyone under 18. If you believe a child has an account, contact support@barvaapp.com and we will remove it.
Changes
If this policy changes materially, we will say so in the app before the change takes effect. The date at the top always reflects the current version.